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About This Book 

This book provides instructions on using XACCTpacketSight. It covers all the aspects of 
the system you need to know and understand to take full advantage of its advanced features. 

This book is organized as follows: 

Chapter 1 , "Overview," includes an overview of the system. It provides a description of its 
components and operation. 

Chapter 2, "Installing XACCTpacketSight " contains a description of the steps you must 
perform to install XACCTpacketSight and the Information Source Modules. 

Chapter 3, "Configuring XACCTpacketSight," contains a description of the data flow in 
the system and provides a detailed explanation of the system configuration options and 
procedures. 

Chapter 4, "System Management and Maintenance," describes tasks that should be done 
on a routine basis. 

Chapter 5, "System Specifications," lists the system specifications. 

Appendix A, "XACCTpacketSight Files," lists the files and directories installed by 
XACCTpacketSight. 
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Document Conventions 

The following typographic conventions are used in this book: 



Typeface or 
Symbol 


Meaning 


Example 


Italics 


References to other 
documents, new terms, 
and placeholders. 


For instructions on configuring the 
Information Source Module, see the 
Information Source Module Guide of the 
corresponding ISM. 

Type UlShostnameiSSSS 


Bold 


Names of menus, options, 
command buttons, and 
fields. 


From the Object menu, choose Edit. 

In the Name box, type the name of the 
report. 


Monospace 


Command-line input, on- 
screen computer output, 
sample code examples, 
names of files, 
commands and 
directories in UNIX. 


Execute the following command: 

ps -ef 1 fgrep void 

The following message appears on your 
screen: 

XACCT Installation 
complete . 


Monospace 
Bold 


What you type contrasted 
with computer output. 


Type the following: 
. /xacctinstall . 
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Overview 1 = 



XACCTpacketSight is a passive network analysis software packaged as an appliance on a 
standalone computer. It increases existing solutions provided by the XACCTusage product 
line. It provides a rich new information source of network protocols, attributes and 
statistical information. The collected data is aggregated and enhanced by XACCTusage, 
providing you with a significant business infrastructure to address problems such as 
intranet traffic classification and analysis. 

XACCTpacketSight does sophisticated session reconstruction and application 
reconstruction of most of the popular network protocols. It is designed to fit seamlesly into 
XACCTusage, to maximize the value of the collected data. 

XACCTpacketSight can automatically classify over 750 different network protocols and 
applications in over 3300 combinations. That gives it the broadest, real-time, classification 
capability available in the industry today. Included in this capability are provisions for the 
complicated, state-based factors required to classify fragmented IP traffic and applications. 

XACCTpacketSight inserts itself into the TCP stack and inspects the individual packets. 
The XACCTpacketSight can be configured to only look at network traffic that concerns the 
machine it is running on or to look at all traffic on the network segment. A typical use 
would be to load XACCTpacketSight on a database server. This would determine how 
much network traffic is needed to handle various transactions. 
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XACCTpacketSight Technology 

XACCTpacketSight is a part of XACCT's intelligent network information gathering 
architecture. The architecture is not centered around any particular information source. It 
simply provides one more source amongst the hundreds of other possible sources, so the 
data can be correlated, aggregated, merged, filtered, and validated along with all the other 
network information to produce accurate usage measurements and billing records. 

XACCTpacketSight collects basic metrics required to understand the amount of traffic an 
application flow is generating. These statistics include the number of packets or 
transactions as well as the amount of bandwidth consumed and the amount of time per flow. 
This allows a management application to understand the real-time impact an application is 
having on the network. Beyond the basic statistics, XACCTpacketSight can collect metrics 
that measure the responsiveness of an application in the network response time, 
non-responsiveness, jitter, latency, and frame burst rates. These can be used to understand 
the end-user's perceived quality of service. 

System Components 

XACCTpacketSight reads all packets from a network interface group or capture file. The 
Session ISM takes the output from the PacketSight ISM as input. It then processes the data 
to give more meaningful measurements tailored to the users needs. Based on the protocol 
and metrics provided by the PacketSight ISM, the Session ISM will output the appropriate 
information for your billing needs. 

XACCTpacketSight 

XACCTpacketSight is a Network Decision Data Engine (NDDE). It offers a portable, 
scalable and customizable architecture that supplies comprehensive real-time network 
information for incorporation into intelligent networking solutions, such as switching, 
bandwidth management, Quality of Service (QoS), network monitoring, and security. All 
of which are dependent upon identification and classification of dynamic applications. 
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PacketSight ISM 

The PacketSight ISM is what XkCCTusage uses to pull usage and QoS information from 
XACCTpacketSight. The PacketSight ISM is triggered by XACCTpacketSight, which 
indicates that there are flows which can be read. It will read the flows and produce UNIRs 
to be sent to the Gatherer. 

Session ISM 

The Session ISM identifies different types of sessions. It will answer the following 
questions: 

• How long are users staying at new related sites? 

• How long are users staying on certain sites? 

• Are sports sites more popular than news sites? 

• How long is a typical user session? 

Using the PacketSight ISM and Session ISM assists you in getting more specific and 
granular data. 
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Installing XACCTpacketSight 



This chapter steps you through the installation procedure for XACCTpacketSight. Before 
proceeding you must already have a system running XACCTw^age 3.4. If you do not, 
please refer to Chapters 2 and 3 of the XACCTusage 3.3 User Guide and install it on a 
system. Only one system needs XACCTusage running. This will be your base system 
including the Central Event Manager (CEM). All of your data collecting systems will need 
both XACCTpacketSight and a Gatherer installed. The Information Source Modules (ISM) 
will be installed on the system running XACCTusage, 

System Requirements 

These are the system requirements for XACCTpacketSight on Gigabit Ethernet and Fast 
Ethernet: 

Gigabit Ethernet 

• Solaris™ 7 running on Sun® Sparc® platform 

• Sun Enterprise 420R 4x450-MHz UltraSPARC-II processors (64 bit architecture) 

• 2 GB of RAM on a dedicated computer 
1 8.2 GB internal hard disk 

• 2xPl 000-SX Gigabit Ethernet network interface PCI cards 
CD-ROM drive for the installation 
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Fast Ethernet 

• Solaris™ 7 running on Sun® Sparc® platform 

Sun Enterprise 220R 2x450-MHz UltraSPARC-II processor (64 bit architecture) 

• 1 GB of RAM on a dedicated computer 
1 8.2 GB internal hard disk 

• Quad Fast Ethernet PCI card (Antares) 

• CD-ROM drive for the installation 

Stages in the Installation 

Installation includes the following stages: 

1 Turning off Auto-Negotiation. (Sun Gigabit Ethernet cards) 

2 Checking for previous installations of XACCTpacketSight. 

3 Removing previous installations of XACCTpacketSight if it exists. 

4 Installing XACCTpacketSight on systems that v^ill be collecting network data. 

5 Installing Gatherers on the same systems in step 1 . 

6 Checking to make sure the XACCTusage CEM is running. 

7 Installing the PacketSight ISM. 

8 Installing the Session ISM. 

9 Installing the Universal Text File ISM. 
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Turning off Auto-Negotiation (Sun Gigabit Etiiernet Cards) 

The Sun Gigabit Ethernet cards must have Auto-Negotiation turned off. This can be done 
by updating the following file: 

/kernel/drv/ge . conf 

Add the parameter adv_1000autoneg_cap=0 to the file. If the file does not exist, 
follow these steps: 

1 Use the following grep command to obtain the hardware path names for the ge 
devices in the device tree: 

• grep ge /etc/path_to_inst 

Typically the path names and the associated instance numbers will be present in the 
/etc/path_to_inst file. Here's an example of the output: 

"/pci®lf ,4000/network@4" 1 "ge" 
"/pci®lf ,4000/network®2" 0 "ge" 

• The first part within the double quotes specifies the hardware node name in the 
device tree. 

• The second number is the instance number. 

• The last part in double quotes is the driver name. 

2 From the output in step 1, create the following ge . conf file: 

# ge . conf setting autonegotiation to off 

name="pcil08e, 2bad" parent=" /pci@lf , 4000" unit-address="4" 
adv_1000autoneg_cap=0 ; 

name="pcil08e, 2bad" parent="/pci@lf , 4 000" unit-address="2" 
adv_1000autoneg_cap=0 ; 



3 Reboot the system 
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Installing XACCTpacketSight 

XACCTpacketSight goes on all systems that will be collecting network data. Run the 
XACCTpacketSight installation program from the distribution CD. The following section 
describes the procedures for mounting the CD. 

Note: You must have super user (root) privileges to install XACCTpacketSight. If you do not 
have such privileges, consult your system administrator on how to obtain them. 

Checking for Previous Installations 

This section will show you how to check for a previous installation of XACCTpacketSight. 
If a previous installation does exist, proceed to the next section, "Removing 
XACCTpacketSight". If a previous installation does not exist, proceed to "Mounting the 
Distribution CD", 

Run the following command to see if XACCTpacketSight is already installed: 
pkginfo XCCTpkst 

If XACCTpacketSight appears as part of the output, it is currently installed. In which 
case, proceed to the next section, "Removing XACCTpacketSight". If 
XACCTpacketSight does not appear, proceed to the "Mounting the Distribution CD" 
section. 

Note: If pkginfo XCCTpkst doesn't return information, enter pkginfo XCCTmf Iw. 

Removing XACCTpacketSight 

To remove XACCTpacketSight from your system, do the following steps: 

1 Enter pkgrm XCCTpkst 

2 Reboot the system. 

This will remove all of the directories and files which were installed by any previous 
XACCTpacketSight installations. 
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Mounting the Distribution CD 



1 Verify that the daemon void is active on your Solaris system by executing the 
command; 

ps -ef I fgrep void 
You should see a line like this: 

rootl85 1 0 Nov 17? 0 : Ol/usr/sbin/vold 

If the void demon is not running, start it. For instruction on the procedure, see your 
Solaris documentation. 

2 Put the distribution CD in your CD-ROM drive. The void daemon automatically 
mounts the CD. 
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Running the Installation Program 

To start the installation program 

1 Entered / cdr cm to change to the cdrom directory. 

2 Enter Is to list the files on the CD-ROM. 

3 A file named XCCTpkst will be one of the files listed. 

4 Enter pkgadd -d . XCCTpkst to run the installation program. 

5 If you see this message: 

Cannot unload module: meterflow 

This means that the previous version of the module is still running and could not be 
unloaded. You will need to reboot the system after installation for meterflow to load. 

6 A list of your interfaces are then listed. Select which data interfaces you would like 
monitored. You can choose up to 6. If you would like to only select 1 , enter a number 
from the device list for the first selection, and '0' for the second selection. 

• For Gigabit Ethernet, select pgeO and pgel. 

• For Fast Ethernet, select qfeO and qfel. 

7 Installation is then complete. If you received the message in step 5, remember to reboot 
the system. 
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Checking What was Installed 



If you would like to see how many files and directories were installed type the following 
command: 

pkginfo -1 XCCTpkst 

The output will look similar to the following: 



PKGINST 


XCCTpkst 




NAME 


XACCTpacketSight 




CATEGORY 


application 




ARCH 


spare 




VERSION 


1.0.0.2 




VENDOR 


XACCT Technologies 


Inc . 


DESC 


XACCT PacketSight 




PSTAMP 


XACCTpacketSightl . 0 


.0.2_20000914 


INSTDATE 


Sep 14 2000 11:26 




HOTLINE 


Please contact your 


local service 



provider 
STATUS: completely installed 
FILES: 19 installed pathnames 



7 shared pathnames 
11 directories 



4 executables 



2499 blocks used (approx) 
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Changing Data Interfaces to be Monitored 

You can monitor up to 2 data interfaces at any given time. If you would like to change the 
data interfaces you are currently monitoring, use the mfsetup utility. 

To run MFSETUP: 

1 Change directories to /usr/local/bin/ 

2 Enter , /mfsetup 

The output will look similar to the following: 

Max interfaces allowed to select: 6 
Select data interface (s) to be monitored. 
Device List: 

1 hmeO 

2 pgeO 

3 qfeO 

4 qfel 

5 qfe2 

6 qfe3 

Total interfaces found to select from: 6 
Select ([1-6] or 0 for end selection): 

To confirm what you have selected, enter the following command: 

cat /usr/kernel/drv/meterf low . conf 

The output will look similar to the following: 

Copyright (c) 2000 XACCT Technologies, Inc. 

name=meterf low parent=pseudo ; prommode=l; 
datasrcl=/dev/hmeO ; 
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Installing a Gatherer 

A Gatherer must be installed on the same systems you installed XACCTpacketSight. To 
install a Gatherer, please refer to pages 56-59 of iho XACCTusage 3.3 User Guide. On page 
58, be sure that (3) Gatherer is the only one that says 'Yes'. 

Ensuring the CEM is Running 

The XACCTusage CEM must be running in order for an ISM to be installed. The XACCT 
components are background processes. To check whether the CEM is currently executing, 
type the following command: 

ps -ef I grep jre 

This command should produce output resembling the one shown below (the process 
numbers and dates will vary): 

root 29495 1 0 19:15:26 ? 2:13 java -noverify 

-mx96m -DMaxHeapMemory=96 CEM cem.ini jre 



If the CEM process is not listed, start XACCTusage manually using the command 
/etc/init .d/xacct start. Then perform this test again. 
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Installing The PacketSight Information Source Module 

To run the PacketSight Information Source Module (ISM) installation program, you need 
root user access rights for the host on which the Central Event Manager is installed. 

Note: The PacketSight ISM must be installed before the Session ISM. 

To run the Module Installation program 

1 Log in as root user. 

2 Copy the PacketSight.tarZ file from the CD-ROM to your /tmp directory. 

3 Enter cd /tmp to change to your tmp directory. 

4 Extract the files from the compressed distribution file by executing the following 
command: 

zcat PacketSight .tar. Z | tar xvf - 

5 Execute the following command: 
. /xacct_upgrade 

The XACCTusage installation program starts. The program runs automatically 
informing you of the actions performed and asking you to confirm and select options. 

6 When prompted to read the End-user License Agreement, press Enter to display the 
text. 

7 Read the End-user License Agreement. 

8 Do one of the following: 

• Type y and press Enter, if you agree with the terms of the End-user License 
Agreement. The installation program proceeds to the next step. 

• Type n and press Enter, if you do not agree with the terms of the End-user 
License Agreement. The installation program shuts down. 

If you accepted the terms of the End-user License Agreement, the list of components 
you can install displays. 
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XACCTusage Module Installation 

You may choose components that will not be installed, by 
selecting their number or you can press c to continue, q to 
quit 

Install Name Description 
1 Yes PacketSight 
Your selection : c 

9 Select the components you want to install following the instructions on your screen. 
Use the following procedures to enter your selection. 

• To change the installation status of a system component on the list (to alternate 
between Yes and No), type the number of the component and press Enter. 

• To continue with installation, type c and press Enter. The components selected 
to be installed (marked with Yes) will be installed. 

• To quit the installation program, type q and press Enter. 

The selected components are installed. If installation is successful, the Central Event 
Manager sends the modules you have installed to the appropriate host or hosts. If 
installation is not successful, you get a notification with a description of the problem. 

10 Repeat steps 1 through 7 for the Session ISM and Universal Text File ISM. 
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XACCTpacketSight starts reading and collecting packets as soon as you install it. It 
collects in excess of 180 fields. You use XACCTw^age to configure which of those 180 
fields you want to process. 

This chapter covers how to use XACCTusage to configure the XACCTpacketSight. It will 
walk you through from beginning to end how to configure Gatherers, IS Ms, Enhancement 
Procedures, fields, and queries. To learn more on how to access and work with the XACCT 
User Interface, please refer to Chapter 4 of the XACCTusage 3.3 User Guide. It can be 
found in PDF format either on the XACCTusage installation CD, or in the / xa c c t / do c s 
directory on your hard disk. 

This chapter will walk you through the following: 

• Adding and configuring a Gatherer 
Configuring the PacketSight ISM 

• Configuring the Session ISM 

• Configuring the Universal Text File ISM (UTF) 

• Adding a new Table 

• Setting up Enhancement Procedures 

• Enhancing Fields 

• Creating a Query for the new Table 

This chapter will show you how to do each of the above tasks once. For tasks such as 
adding and configuring a Gatherer, you will need to do this several times, once for each 
system you will be using to collect data. 
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The Flow of Data 

Once your customer begins using the Internet, sessions begin to be created. 
XACCTpacketSight efficiently evaluates each packet and generates the results in real time. 
The PacketSight ISM captures the information from XACCTpacketSight. The PacketSight 
ISM turns the data into a Unified Network Information Record (UNIR). The UNIR is then 
pulled into the Gatherer. The Gatherer sends the UNIR to the Session ISM where it is 
processed and enhanced by the Universal Text File (UTF) ISM, The UNIR is then 
forwarded to the Central Event Manager (CEM). From here, the data goes to two different 
places. It goes to the Central Database (CDB) to be stored and to the XACCT Interface 
Server (XIS). The XIS converts the data into a comma separated value (CSV) file format 
to be stored in WhiteCross. 

Initial System Configuration 

Before you can begin using the configuration of XACCTpacketSight you need to have 
XACCTusage already up and running. This includes having it licensed and connected to 
the other systems from which you will be collecting data. 

To configure XACCTpacketSight after initial installation you must do the following in the 
order specified: 

1 Add the Gatherers. 

2 Add the Information Source Modules for each Gatherer. 

3 Configure the Information Source Modules. 

4 Add a table. 

5 Define the Enhancement Procedures. 

6 Check how Field Enhancements are defined and modify them if necessary. 

7 Add a query for the new table. 
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Before you begin configuring XACCT usage, make sure that: 

1 XACCTusage is properly installed and licensed. 

Note: The Gatherer software must be installed on all computers on which you want to 
have Gatherers. 

2 XACCTpacketSight software, PacketSight ISM, Session ISM, and Universal Text File 
ISM (UTF) have been installed. 

Note: Some ISMs are installed with the system. See the section "Adding Information 
Sources" on page 138 of the XACCTusage 3.3 User Guide for the procedures on 
checking available Information Sources. 

3 You know the host names or IP addresses of the computers on which the Gatherer 
software is installed. 

4 You have performed Information Source setup for the Information Sources you intend 
to use (if required), as described in the corresponding Information Source Module 
Guides. 

5 You have Administrator or Manager access rights. 

Tip: After configuring the system, choose Refresh from the View menu to update the screen 
display and view your changes in the XACCT tree. 

Configuring the Gatherers 

The first step in configuring XACCTusage is to add the Gatherers. After you add a 
Gatherer, you can modify its properties. Users with Administrator or Manager access rights 
can add, modify, and delete Gatherers. 
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Adding Gatherers 

To add a new Gatherer 

1 In the XACCT main screen, right-click the Gatherers folder. 

2 Click New Gatherer on the shortcut menu. The Gatherer Configuration dialog box is 
displayed. 



Galheiei Configuralion 



Name: 



Host 



OK 



192.103.22.1 



Cancel 




In the Name box, 
Gatherers. Below 

Gatherer Name 

I0N-KC1 

I0N-KC2 

I0N-KC3 

I0N-KC4 

I0N-DEN1 

I0N-DEN2 

I0N-SEA1 

I0N-SEA2 

LTD-LV1 

LTD-LV2 

LTD-0RL1 

LTD-0RL2 

BWG-PH01 

BWG-PH02 



type the name of the Gatherer. You must use different names for all 
is a list with suggested names. 

Function of Gatherer 

Collects packets in Kansas City 
Collects packets in Kansas City 
Collects from DEN1,DEN2, LV1. LV2, SEA1, SEA2 
Collects from PH02, 0RL1 , 0RL2. KC1 , KC2 
Collects packets in Denver 
Collects packets in Denver 
Collects packets in Seattle 
Collects packets in Seattle 
Collects packets in Las Vegas 
Collects packets in Las Vegas 
Collects packets in Orlando 
Collects packets in Orlando 
Collects packets in Phoenix 
Collects from PH01 
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4 In the Host box, type the name or IP address or name of the host computer on which 
the Gatherer is installed. 

5 We recommend you use the default values for the Port number. Cache Size, and Log 
Size. If you want to change the defaults, click More» to expand the Gatherer 
Configuration dialog box and do the following: 

• To add a Secondary Host, enter the IP Address in the Secondary Host box. 

• To change the port number, in the Port box, type any number between 1025 and 
65000. The default is 5890. You only need to change the port number if another 
application is using the default port number. Note: The port number must be the 
same as the one used when installing the Gatherer. 

• To change the size of the cache you want the Gatherer to use, type the new value 
in the Cache Size box. The value you type can be greater than zero or zero. When 
it is zero, the Gatherer does not use a cache. Increasing the size of the cache will 
speed up the performance of any Data Enhancement Module (DEM) the Gatherer 
hosts. For example, if the Gatherer hosts a DNS Data Enhancement Module, 
DNS address resolution will be faster. Increasing the size of the cache consumes 
more disk space, so if the Gatherer will not host a DEM, it is best not to increase 
the cache size. 

• To change the size of the log file, type the new value in the Log Size box. 
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6 Click OK to close the Gatherer Configuration dialog box. The new Gatherer is added 
to the system configuration and its icon and name appear in the Gatherers folder. 

Notes 

1 . If the new Gatherer cannot be added to the system, a message identifying the problem is 
displayed. 

2. You can also add a Gatherer using the toolbar and the menu to carry out the New 
command. (See the section "Creating New Objects" on page 116 of the XACCTusage 3.3 
User Guide for additional details.) 

For additional information on how to modify, or delete a Gatherer, please refer to pages 
136-137 of thQ XACCTusage 3.3 User Guide, 

Adding the PacketSight ISM to the XACCTusage Configuration 

Before you add the PacketSight ISM to XACCTusage, make sure that PacketSight ISM has 
been installed on the host computer of the CEM. There are several ways in which you can 
add an ISM to the XACCTusage configuration: using the shortcut menu, the Object menu, 
or the New button on the toolbar. The first option is described in the following procedure. 

To add a new PacketSight ISM 

1 In the XACCT tree, right-click the Gatherer to which you want to add the PacketSight 
ISM, and then click New Information Source. 



^lrrv^•■ Iniutm-ition ^^l:lurce^... | 


New... 






Edit... 






Delete 






Properties 
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2 In the Name box, type a unique name for this Information Source. 



^Information Source ConMguratic r 
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mm 
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jy/arhing: Applet Window 



Here are suggested names for the PacketSight ISMs. 

PacketSight ISM Names 
PS-KCI 
PS-KC2 



PS-DEN 1 
PS-DEN2 
PS-SEA 1 
PS-SEA2 



PS-LVl 
PS-LV2 
PS-ORLl 
PS-0RL2 
PS-PHOl 



3 From the lype list, select PacketSight. 
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4 Click Next. A screen appears confirming that configuration of the PacketSight ISM 
has been successful. This may take a minute or two as the ISM is now being 
downloaded to the Gatherer. 

5 Click Finish to complete the procedure. 

Adding The Session ISM to the XACCTt/sage Configuration 

Before you add the Session ISM to XACCTusage, make sure that the Session ISM has been 
installed on the host computer of the CEM. There are several ways in which you can add 
an ISM ot the XACCTusage configuration: using the shortcut menu, the Object menu, or 
the New button on the toolbar. The first option is described in the following procedure. 

The Session ISM will need to be added to the following systems: 

Ses-KC3 
Ses-KC4 
Ses-PH02 

To add a new Session ISM 

1 In the XACCT tree, right-click the Gatherer to which you want to add the Session 
ISM, and then click New Information Source. 



New InroifiiCition -source... 
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2 In the Name box, type a unique name for this Information Source. A suggested name 
is Ses-KC3. 




3 From the Type list, select Session and then click Next. A screen appears allowing you 
to select the information source from which the input fields will be acquired. 
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4 Check the Use the output fields of the selected Data Collection Module box. 



[^Information Source Configuration 
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jWarninff Applet Window 



5 From the Information Source Name list, select PS-KCl. The fields output by the 
selected information source will be used as the basic input fields of the Session ISM. 
Click Next. 
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6 The next screen allows you to set the session timeouts. A 30 minute timeout means if 
there is no activity within 30 minutes, the session will be closed and the session ID is 
stored. If there is activity after the 30 minutes, a new session will be started with a new 
session ID. Enter a number from 1 to 60 in each of the Minutes boxes. 




7 Click Finish to save the new Session IS. 
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Adding the Universal Text File ISM to the XACCTusage 
Configuration 

The Universal Text File (UTF) ISM will convert domain names into the categories your 
text file is providing. Your text file should provide sites and the categories you want them 
broken down into. Before you add the UTF ISM to XACCTusage, make sure that the UTF 
ISM has been installed on the host computer of the CEM. There are several ways in which 
you can add an ISM ot the XACCTusage configuration: using the shortcut menu, the 
Object menu, or the New button on the toolbar. The first option is described in the 
following procedure. 

To add a new UTF ISM 

1 In the XACCT tree, right-click the Gatherer to which you want to add the UTF ISM, 
and then click New Information Source. 
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2 In the Name box, type a unique name for this Information Source. A suggested name 
is Categories. 



Information Source Configuiation O 




3 From the Type list, select Universal Text File and then click Next. 
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4 Enter the Path of the sites and categories text file you are providing in the File Name 
and Location box. 




5 Enter the Path of the sites and categories text file you are providing in the File Name 
and Location box. 

6 Select the default Regular Expression in the File Type drop-down box. 

7 Use the Skip Rows box if your text file contains lines that are not data lines at the 
beginning, replace the default value (zero) with the number of lines you want the 
module to skip during scans. 

8 If your text file has comments introduced by a character (or character sequence), type 
the character (or character sequence) in the Line Comment box. 
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9 Use the Scan Interval box to indicate how frequently the module checks the text file 
for changes. 

10 Click Next to proceed. The Regular Expression Box appears 



tformatton Source Configuration 



i y:Enter^egulari8Kpression to-descnbe the structOrlQnihe.file^Desfiribsjallfields and 
"pm the: oftes you want to.use^as output fieldsi in pa mnm 
results.'Click-Reset toMew the filer V; ; 




Field D 



yahoo.com 

msn.com 

go.com 



PORTALS 
PORTALS 
PORTALS 



< I ■ •••• 



11 In the Regular Expression box, type a regular expression using regular expression 
syntax to describe the structure of the file: the collection of fields that each record 
contains and the separator used. 

We recommend this Regular Expression: (\S+)\s+(\S+) 

For addional information on Regular Expressions, please refer to Appendix A of the 
Universal Text File ISM Guide. It's located in PDF format in /xacct/docs on your 
CEM's hard disk. 
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Note: Describe all fields that appear in the file and enclose the fields you want the ISM 
to read in parentheses. 

1 2 Click the Test button to test the regular expression. The Data Preview box shows how 
the ISM parses the data in the file using the regular expressions you have entered; it 
displays all fields the ISM reads. If you are satisfied with the way the ISM reads the 
file, click Next. If you want to modify the regular expression, repeat the previous step. 
If you want the Data Preview box to display the original view of the file (the view that 
shows the data before it is parsed by the ISM), click Reset. 

13 In the next screen that displays, define the properties of each data field as follows: 




iilWaning Apptet Window : ; ~r~:~~J^ 



14 Click on the first column heading to select the field. 

15 Click the Yes radio button for the Input Field. 
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16 From the Field Type list, choose String. 

17 Select MF URL Domain as the output field from the Output Field list. 

18 Click on the second column heading to select the field. 

19 Click the No radio button for the Input Field. 

20 From the Field Type list, choose String. 

21 Select Facility Category as the output field from the Output Field list. 

22 Click Next to display the final screen of the Information Source Configuration Wizard. 



[mi:^^^^^ process the file and 
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?^:\.:con(iguratlflntCavoid potential mndme problemsj 








: Finish 


jWarmg: Applet Window 



23 Click the Test button to find out how much time it takes to process the file. Use the 
results as a gauge to determine the resources you need. 
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Adding a Table 



A default primary table is installed with XACCTusage. This section will walk you through 
adding a table with the fields for your specific requirements. You add tables using the Table 
wizard. You can start the wizard using the toolbar, the menu bar, or the shortcut menu. The 
following procedure describes the latter option. 

To add a new table 

1 In the XACCT main screen, right-click the Tables folder, and then cUck New Table 
on the shortcut menu. The Table wizard starts. 



hji Table Configuration 




2 Enter Sprint in the Name box. 
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3 Add a Description of the table. (Optional) 

4 Select Partitioned from the Structure drop-down box. 

5 Select Bulk Inserts from the Update Method drop-down box, 

6 Enter the number of days you want the database to store the data in the Data Expires 
after box. 

7 Click Next to select the Information Source keys you want to add the table. 

8 Click on the Session ISM to highlight it. 

9 Click Next to select the fields. 




>3'locatlorfAreatCode (String) 
M^Routing Area (String) . ■ 




iHTT^ Response CpdeKlnteg | 

mf;cs art ES''sum^<^ib^^ 1 
:MF.€8^T^ES Sum XOntege j 
:1VIF CS7WT/ESSum)a^{Floal 
ivlFes-ARTiBE l^axX dhteger 

„ ■ 



■II 



■IB 



, , ■ . . . . ^ 



"Fihish'H 
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For names and descriptions of all available fields, please refer to the "Output Fields" 
section of the "PacicetSigiit ISM and Session ISM Manuals. " 
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1 0 Click Finish to add the table and save the table properties. 

For additional information on adding tables, please refer to pages 175-177 in the 
XACCTusage 3.3 User Guide, 



The ISMs provide you with all the fields you requested. There may be times when you 
would like to add more fields for your reporting and billing needs. For information on how 
to add a field, please refer to pages 183-185 of thQ XACCTusage 3.3 User Guide, 



This section walks you through setting up two Enhancement Procedures. For general 
information on configuring Enhancement Procedures, please refer to pages 144-173 of the 
XACCTusage 3.3 User Guide. 

These are the two Enhancement Procedures you will be configuring: 

1 PacketSight to Session 

2 Session to Central Database 

The first Enhancement Procedure uses the PacketSight ISM as the trigger to pull the data 
from XACCTpacketSight and pass it on to the target Session ISM, which is the Data 
Processing Module. The second Enhancement Procedure uses the Session ISM as the 
trigger to forward the data to the CDB. 



Adding Fields 



Configuring 



the Enhancement Procedures 
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Configuring Enhancement Procedure No. 1 

You will need to set up Enhancement Procedure No. 1 for each of the following ISMs: 

PS-KCl 

PS-KC2 

PS-DEN 1 

PS-DEN2 

PS-SEA 1 

PS-SEA2 

PS-LVl 

PS-LV2 

PS-ORLl 

PS-ORL2 

PS-PHOl 

To set up the first Enhancement Procedure 

1 Right-click on the Enhancement Procedures folder, and then click New 
Enhancement Procedure. The Enhancement Procedure Configuration dialog box is 
displayed. 

2 In the Name box, type PS-KCl to Ses-KC3 to describe the information going from 
the PS-KCl ISM to the Ses-KC3 ISM. 

3 In the Description box, type a description. (Optional) The description will be 
displayed when the properties of the Enhancement Procedure are viewed. 

4 From the Trigger list, choose PS-KCl . 

5 From the Target Type list, choose Data Processing Module. 

6 From the Target Name list, choose Ses-KC3. 

7 From the Reliability Mode list, select None (Fast) for the reliability level. 

8 Keep the Enabled box empty for now. We will enable it after Enhancement Procedure 
No. 2 is configured and the necessary fields are enhanced. 

9 Click OK to save the Enhancement Procedure. 
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Configuring Enhancement Procedure No. 2 

You will need to set up Enhancement Procedure No. 2 for each of the following ISMs: 

Ses-KC3 
Ses-KC4 
Ses-PH02 

To set up the second Enhancement Procedure 

1 Right-click the Enhancement Procedures folder, and then click New Enhancement 
Procedure. The Enhancement Procedure Configuration dialog box is displayed. 

2 In the Name box, type Ses-KC3 to CDB to describe the information going from the 
Ses-KC3 ISM to the Central Database Table. 

3 In the Description box, type a description. (Optional) The description will be 
displayed when the properties of the Enhancement Procedure are viewed. 

4 From the Trigger list, choose the Ses-KC3 ISM. 

5 From the Target Type list, choose Central Database Table. 

6 From the Target Name list, choose the tableSprint. 

7 From the Reliability Mode list, select None (Fast) for the reliability level. 

8 Keep the checkmark in the Store in DB box. 

9 Keep the Enabled box empty for now. We will modify it after the necessary fields are 
enhanced. 

10 Click OK to save the Enhancement Procedure. 

Defining Field Enhancements 

The Facility Category field needs additional enhancements. 

1 Click the plus sign in the box next to the PS-KCl to Ses-KC3 Enhancement 
Procedures to display the fields. 

2 Right-click on the Facility Category field and select Edit. 
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3 Click the Continue button. From the drop-down box select UTF.Get(MF URL 
Domain: String)->(Facility Category) 

4 From the URL Domain drop-down box, select MF URL Domain. 

5 Click the End button. From the drop-down box select UTF...Facility Category. 

Enable both Enhancement Procedures 

1 Right-click the PS-KCl TO Ses-KC3 Enhancement Procedure, and then click Edit. 

2 Click the Enabled check box. A check mark appears in the box. 

3 Click OK to close the Enhancement Procedure Configuration dialog box. The 
Enhancement Procedure is activated. 

4 Repeat steps 1-3 for the Ses-KC3-CDB Enhancement Procedure. 

Creating a Latest Data Query for the New Table 

To create a Latest Data Query for the new table. 

1 In the XACCT tree, click the Queries folder to display the existing queries. 

2 Right-click on the Latest Data query and select Edit. 

3 Change the Name of the Query to Latest Data for Sprint. 

4 From the Table drop-down box, select Sprint. 

5 Select the Output Fields you would like and click the Next button. 

6 Click the Next button the rest of the way through until you reach the Finish button. 

To run the Latest Data for Sprint query. 

1 Right-click on the Latest Data for Sprint query. 

2 Select Run. 
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System Management and Maintenance 4 — 



This chapter describes the maintenance and management of XACCTpacketSight. It 
includes information on the following topics: 

• Turning on Notrouter. 

• Changing data interfaces to be monitored. 

• Checking which data interfaces are currently being monitored. 

Turning on Notrouter 

Notrouter needs to be turned "on" in order for XACCTpacketSight to run successfully. 
Notrouter is turned on during XACCTpacketSights package installation. Notrouter is 
normally on by default on most systems. There are two reasons XACCTpacketSight needs 
Notrouter turned on: 

1 XACCTpacketSight doesn't want the hardware it is installed on to act like a router 

2 With XACCTpacketSight turned on, there hardware will not perform IP Forwarding. 

Note: If for some reason you decide to use the current system running XACCTpacketSight 
for something else later, you will most likely want to remember that XACCTpacketSight 
turned on Notrouter. 
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Changing Data Interfaces to be Monitored 

You can monitor up to 2 data interfaces at any given time. If you would like to change the 
data interfaces you are currently monitoring, use the mfsetup utility. 

To run MFSETUP: 

1 Change directories to /usr/local/bin/ 

2 Enter , /inf setup 

The output will look similar to the following; 

Max interfaces allowed to select: 6 
Select data interface (s) to be monitored. 
Device List: 

1 hmeO 

2 pgeO 

3 qfeO 

4 qfel 

5 qfe2 

6 qfe3 

Total interfaces found to select from: 6 
Select ( [1-6] or 0 for end selection) : 

Checking Which Data Interfaces are Currently Being Monitored 

To check which data interface are currently being monitored, enter the following 
command: 

cat /usr/kernel/drv/meterf low . conf 

The output will look similar to the following: 

Copyright (c) 2 00 0 XACCT Technologies, Inc. 

name=meterf low parent=pseudo; prommode=l; 
datasrcl=/dev/hmeO ; 
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Platforms 

You can install XACCTpacketSight on the following: 

• Solaris 2.7 or later running on Sun Sparc platform. 

Relational Database Management Systems 

You can use XACCTw^a^e with one of the following Database Management Systems: 

• Oracle Server 7.3 or 8.0.5 on any platform. 



Browsers 



The XACCT User Interface is accessible from Win32 platforms (Microsoft Windows 95 
and Microsoft Windows NT) through the following browsers: 

• Netscape Navigator 3.01 or later with Java™ Plug-in on the XACCTusage CD. 

• Microsoft Internet Explorer 3.02 or later with Java™ Plug-in on the XACCTusage 
CD. 
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Information Source Modules 

The Information Source Modules we recommend to use with XACCTpacketSight are the 
following: 

• PacketSight ISM 

• Session ISM 

• Universal Text File ISM 

Note: For a complete list of available Information Sources, refer to http://www.xacct.conn . 

Network Interface Cards 

These are the required Network Interface Cards (NICs) for both Gigabit Ethernet and Fast 
Ethernet: 

Gigabit Ethernet: 

• PhobosPlOOO-SX 

Fast Ethernet: 

• Antares P-0075 
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Below are a list of the files and directories installed by XACCTpacketSight: 

XCCTpkst 

XCCTpks t /pkgmap 

XCCTpkst/pkginf o 

XCCTpkst/root 

XCCTpkst /root /etc 

XCCTpkst /root /etc/notrouter 

XCCTpkst /root /kernel 

XCCTpkst/ root /kernel/strmod 

XCCTpkst /root /kernel/strmod/ sparcv9 

XCCTpkst/root/kernel/strmod/sparcv9/mf lowmod 

XCCTpkst/ root /usr 

XCCTpkst/ root/usr/kernel 

XCCTpkst/ root/usr/kernel/drv 

XCCTpks t / root /usr /kerne 1/drv/met erf low 

XCCTpkst/root/usr/kernel/drv/tneterf low . conf 

XCCTpkst /root /usr/ local 

XCCTpkst/root/usr/ local /bin 

XCCTpkst/root/usr/ local /bin/mf setup 

XCCTpkst /root /usr /local /doc 

XCCTpkst/root/usr/ local /doc/xacct 

XCCTpkst/ root/usr/local/doc/xacct/ ins tall_config_guide . 

XCCTpkst/root/usr/local/doc/xacct/readme . txt 

XCCTpkst/install 

XCCTpkst /ins tall /post ins tall 

XCCTpkst/ ins tall/preremove 
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